Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(100)

Side by Side Diff: third_party/WebKit/Source/core/svg/UnsafeSVGAttributeSanitizationTest.cpp

Issue 1686483002: Oilpan: Remove most WillBe types from the code base (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Created 4 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright 2015 The Chromium Authors. All rights reserved. 1 // Copyright 2015 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 // FIXME(dominicc): Poor confused check-webkit-style demands Attribute.h here. 5 // FIXME(dominicc): Poor confused check-webkit-style demands Attribute.h here.
6 #include "core/dom/Attribute.h" 6 #include "core/dom/Attribute.h"
7 7
8 #include "core/HTMLNames.h" 8 #include "core/HTMLNames.h"
9 #include "core/SVGNames.h" 9 #include "core/SVGNames.h"
10 #include "core/XLinkNames.h" 10 #include "core/XLinkNames.h"
(...skipping 163 matching lines...) Expand 10 before | Expand all | Expand 10 after
174 174
175 // Unit tests 175 // Unit tests
176 176
177 // stripScriptingAttributes inspects animation attributes for 177 // stripScriptingAttributes inspects animation attributes for
178 // javascript: URLs. This check could be defeated if strings supported 178 // javascript: URLs. This check could be defeated if strings supported
179 // addition. If this test starts failing you must strengthen 179 // addition. If this test starts failing you must strengthen
180 // Element::stripScriptingAttributes, perhaps to strip all 180 // Element::stripScriptingAttributes, perhaps to strip all
181 // SVG animation attributes. 181 // SVG animation attributes.
182 TEST(UnsafeSVGAttributeSanitizationTest, stringsShouldNotSupportAddition) 182 TEST(UnsafeSVGAttributeSanitizationTest, stringsShouldNotSupportAddition)
183 { 183 {
184 RefPtrWillBeRawPtr<Document> document = Document::create(); 184 RawPtr<Document> document = Document::create();
185 RefPtrWillBeRawPtr<SVGElement> target = SVGAElement::create(*document); 185 RawPtr<SVGElement> target = SVGAElement::create(*document);
186 RefPtrWillBeRawPtr<SVGAnimateElement> element = SVGAnimateElement::create(*d ocument); 186 RawPtr<SVGAnimateElement> element = SVGAnimateElement::create(*document);
187 element->setTargetElement(target.get()); 187 element->setTargetElement(target.get());
188 element->setAttributeName(XLinkNames::hrefAttr); 188 element->setAttributeName(XLinkNames::hrefAttr);
189 189
190 // Sanity check that xlink:href was identified as a "string" attribute 190 // Sanity check that xlink:href was identified as a "string" attribute
191 EXPECT_EQ(AnimatedString, element->animatedPropertyType()); 191 EXPECT_EQ(AnimatedString, element->animatedPropertyType());
192 192
193 EXPECT_FALSE(element->animatedPropertyTypeSupportsAddition()); 193 EXPECT_FALSE(element->animatedPropertyTypeSupportsAddition());
194 } 194 }
195 195
196 TEST( 196 TEST(
197 UnsafeSVGAttributeSanitizationTest, 197 UnsafeSVGAttributeSanitizationTest,
198 stripScriptingAttributes_animateElement) 198 stripScriptingAttributes_animateElement)
199 { 199 {
200 Vector<Attribute> attributes; 200 Vector<Attribute> attributes;
201 attributes.append(Attribute(XLinkNames::hrefAttr, "javascript:alert()")); 201 attributes.append(Attribute(XLinkNames::hrefAttr, "javascript:alert()"));
202 attributes.append(Attribute(SVGNames::fromAttr, "/home")); 202 attributes.append(Attribute(SVGNames::fromAttr, "/home"));
203 attributes.append(Attribute(SVGNames::toAttr, "javascript:own3d()")); 203 attributes.append(Attribute(SVGNames::toAttr, "javascript:own3d()"));
204 204
205 RefPtrWillBeRawPtr<Document> document = Document::create(); 205 RawPtr<Document> document = Document::create();
206 RefPtrWillBeRawPtr<Element> element = SVGAnimateElement::create(*document); 206 RawPtr<Element> element = SVGAnimateElement::create(*document);
207 element->stripScriptingAttributes(attributes); 207 element->stripScriptingAttributes(attributes);
208 208
209 EXPECT_EQ(2ul, attributes.size()) << 209 EXPECT_EQ(2ul, attributes.size()) <<
210 "One of the attributes should have been stripped."; 210 "One of the attributes should have been stripped.";
211 EXPECT_EQ(XLinkNames::hrefAttr, attributes[0].name()) << 211 EXPECT_EQ(XLinkNames::hrefAttr, attributes[0].name()) <<
212 "The 'xlink:href' attribute should not have been stripped from " 212 "The 'xlink:href' attribute should not have been stripped from "
213 "<animate> because it is not a URL attribute of <animate>."; 213 "<animate> because it is not a URL attribute of <animate>.";
214 EXPECT_EQ(SVGNames::fromAttr, attributes[1].name()) << 214 EXPECT_EQ(SVGNames::fromAttr, attributes[1].name()) <<
215 "The 'from' attribute should not have been strippef from <animate> " 215 "The 'from' attribute should not have been strippef from <animate> "
216 "because its value is innocuous."; 216 "because its value is innocuous.";
217 } 217 }
218 218
219 TEST( 219 TEST(
220 UnsafeSVGAttributeSanitizationTest, 220 UnsafeSVGAttributeSanitizationTest,
221 isJavaScriptURLAttribute_xlinkHrefContainingJavascriptURL) 221 isJavaScriptURLAttribute_xlinkHrefContainingJavascriptURL)
222 { 222 {
223 Attribute attribute(XLinkNames::hrefAttr, "javascript:alert()"); 223 Attribute attribute(XLinkNames::hrefAttr, "javascript:alert()");
224 RefPtrWillBeRawPtr<Document> document = Document::create(); 224 RawPtr<Document> document = Document::create();
225 RefPtrWillBeRawPtr<Element> element = SVGAElement::create(*document); 225 RawPtr<Element> element = SVGAElement::create(*document);
226 EXPECT_TRUE( 226 EXPECT_TRUE(
227 element->isJavaScriptURLAttribute(attribute)) << 227 element->isJavaScriptURLAttribute(attribute)) <<
228 "The 'a' element should identify an 'xlink:href' attribute with a " 228 "The 'a' element should identify an 'xlink:href' attribute with a "
229 "JavaScript URL value as a JavaScript URL attribute"; 229 "JavaScript URL value as a JavaScript URL attribute";
230 } 230 }
231 231
232 TEST( 232 TEST(
233 UnsafeSVGAttributeSanitizationTest, 233 UnsafeSVGAttributeSanitizationTest,
234 isJavaScriptURLAttribute_xlinkHrefContainingJavascriptURL_alternatePrefix) 234 isJavaScriptURLAttribute_xlinkHrefContainingJavascriptURL_alternatePrefix)
235 { 235 {
236 QualifiedName hrefAlternatePrefix( 236 QualifiedName hrefAlternatePrefix(
237 "foo", "href", XLinkNames::xlinkNamespaceURI); 237 "foo", "href", XLinkNames::xlinkNamespaceURI);
238 Attribute evilAttribute(hrefAlternatePrefix, "javascript:alert()"); 238 Attribute evilAttribute(hrefAlternatePrefix, "javascript:alert()");
239 RefPtrWillBeRawPtr<Document> document = Document::create(); 239 RawPtr<Document> document = Document::create();
240 RefPtrWillBeRawPtr<Element> element = SVGAElement::create(*document); 240 RawPtr<Element> element = SVGAElement::create(*document);
241 EXPECT_TRUE(element->isJavaScriptURLAttribute(evilAttribute)) << 241 EXPECT_TRUE(element->isJavaScriptURLAttribute(evilAttribute)) <<
242 "The XLink 'href' attribute with a JavaScript URL value should be " 242 "The XLink 'href' attribute with a JavaScript URL value should be "
243 "identified as a JavaScript URL attribute, even if the attribute " 243 "identified as a JavaScript URL attribute, even if the attribute "
244 "doesn't use the typical 'xlink' prefix."; 244 "doesn't use the typical 'xlink' prefix.";
245 } 245 }
246 246
247 TEST( 247 TEST(
248 UnsafeSVGAttributeSanitizationTest, 248 UnsafeSVGAttributeSanitizationTest,
249 isSVGAnimationAttributeSettingJavaScriptURL_fromContainingJavaScriptURL) 249 isSVGAnimationAttributeSettingJavaScriptURL_fromContainingJavaScriptURL)
250 { 250 {
251 Attribute evilAttribute(SVGNames::fromAttr, "javascript:alert()"); 251 Attribute evilAttribute(SVGNames::fromAttr, "javascript:alert()");
252 RefPtrWillBeRawPtr<Document> document = Document::create(); 252 RawPtr<Document> document = Document::create();
253 RefPtrWillBeRawPtr<Element> element = SVGAnimateElement::create(*document); 253 RawPtr<Element> element = SVGAnimateElement::create(*document);
254 EXPECT_TRUE( 254 EXPECT_TRUE(
255 element->isSVGAnimationAttributeSettingJavaScriptURL(evilAttribute)) << 255 element->isSVGAnimationAttributeSettingJavaScriptURL(evilAttribute)) <<
256 "The animate element should identify a 'from' attribute with a " 256 "The animate element should identify a 'from' attribute with a "
257 "JavaScript URL value as setting a JavaScript URL."; 257 "JavaScript URL value as setting a JavaScript URL.";
258 } 258 }
259 259
260 TEST( 260 TEST(
261 UnsafeSVGAttributeSanitizationTest, 261 UnsafeSVGAttributeSanitizationTest,
262 isSVGAnimationAttributeSettingJavaScriptURL_toContainingJavaScripURL) 262 isSVGAnimationAttributeSettingJavaScriptURL_toContainingJavaScripURL)
263 { 263 {
264 Attribute evilAttribute(SVGNames::toAttr, "javascript:window.close()"); 264 Attribute evilAttribute(SVGNames::toAttr, "javascript:window.close()");
265 RefPtrWillBeRawPtr<Document> document = Document::create(); 265 RawPtr<Document> document = Document::create();
266 RefPtrWillBeRawPtr<Element> element = SVGSetElement::create(*document); 266 RawPtr<Element> element = SVGSetElement::create(*document);
267 EXPECT_TRUE( 267 EXPECT_TRUE(
268 element->isSVGAnimationAttributeSettingJavaScriptURL(evilAttribute)) << 268 element->isSVGAnimationAttributeSettingJavaScriptURL(evilAttribute)) <<
269 "The set element should identify a 'to' attribute with a JavaScript " 269 "The set element should identify a 'to' attribute with a JavaScript "
270 "URL value as setting a JavaScript URL."; 270 "URL value as setting a JavaScript URL.";
271 } 271 }
272 272
273 TEST( 273 TEST(
274 UnsafeSVGAttributeSanitizationTest, 274 UnsafeSVGAttributeSanitizationTest,
275 isSVGAnimationAttributeSettingJavaScriptURL_valuesContainingJavaScriptURL) 275 isSVGAnimationAttributeSettingJavaScriptURL_valuesContainingJavaScriptURL)
276 { 276 {
277 Attribute evilAttribute(SVGNames::valuesAttr, "hi!; javascript:confirm()"); 277 Attribute evilAttribute(SVGNames::valuesAttr, "hi!; javascript:confirm()");
278 RefPtrWillBeRawPtr<Document> document = Document::create(); 278 RawPtr<Document> document = Document::create();
279 RefPtrWillBeRawPtr<Element> element = SVGAnimateElement::create(*document); 279 RawPtr<Element> element = SVGAnimateElement::create(*document);
280 element = SVGAnimateElement::create(*document); 280 element = SVGAnimateElement::create(*document);
281 EXPECT_TRUE( 281 EXPECT_TRUE(
282 element->isSVGAnimationAttributeSettingJavaScriptURL(evilAttribute)) << 282 element->isSVGAnimationAttributeSettingJavaScriptURL(evilAttribute)) <<
283 "The animate element should identify a 'values' attribute with a " 283 "The animate element should identify a 'values' attribute with a "
284 "JavaScript URL value as setting a JavaScript URL."; 284 "JavaScript URL value as setting a JavaScript URL.";
285 } 285 }
286 286
287 TEST( 287 TEST(
288 UnsafeSVGAttributeSanitizationTest, 288 UnsafeSVGAttributeSanitizationTest,
289 isSVGAnimationAttributeSettingJavaScriptURL_innocuousAnimationAttribute) 289 isSVGAnimationAttributeSettingJavaScriptURL_innocuousAnimationAttribute)
290 { 290 {
291 Attribute fineAttribute(SVGNames::fromAttr, "hello, world!"); 291 Attribute fineAttribute(SVGNames::fromAttr, "hello, world!");
292 RefPtrWillBeRawPtr<Document> document = Document::create(); 292 RawPtr<Document> document = Document::create();
293 RefPtrWillBeRawPtr<Element> element = SVGSetElement::create(*document); 293 RawPtr<Element> element = SVGSetElement::create(*document);
294 EXPECT_FALSE( 294 EXPECT_FALSE(
295 element->isSVGAnimationAttributeSettingJavaScriptURL(fineAttribute)) << 295 element->isSVGAnimationAttributeSettingJavaScriptURL(fineAttribute)) <<
296 "The animate element should not identify a 'from' attribute with an " 296 "The animate element should not identify a 'from' attribute with an "
297 "innocuous value as setting a JavaScript URL."; 297 "innocuous value as setting a JavaScript URL.";
298 } 298 }
299 299
300 } // namespace blink 300 } // namespace blink
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698